The permission control of AIFU cashier management salary query function can be bypassed, thus after obtaining general user�??s permission, the remote attacker can access account information except passwords by crafting URL parameters.